Meta 1 мая показала как они хранят ключи от ваших бэкапов WhatsApp. Разбираю архитектуру и сравниваю

Дисклеймер: в статье несколько раз упомянут мой собственный мессенджер ONEMIX. Если такое триггерит — закройте сейчас, не обижусь. Если интересно как решают одну и ту же инженерную задачу в Meta и в команде из одного человека, поехали. Первого мая на Engineering at Meta вышел пост «How Meta Is Strengthening End-to-End Encrypted Backups». Одиннадцатого мая продолжение про Labyrinth 1.1, реализацию для Android. Я прочитал оба, потом полез в whitepaper, потом сравнил с тем что делаю у себя, и решил написать разбор. Не пересказ маркетингового материала, а нормальный технический разбор. Что они сделали, почему именно так, где у меня болело по дороге, какие компромиссы они выбрали, какие выбрал я. Сразу важная оговорка про что эта статья. Она не про шифрование сообщений в транзите. Signal Protocol, Double Ratchet, X3DH — всё это давно стандарт, все нормальные мессенджеры это используют. WhatsApp лицензировал Signal Protocol ещё в 2016-м. Транзит решённая задача. Эта статья про следующее звено цепи, которое для большинства пользователей до сих пор сломано. Про бэкапы.

https://habr.com/ru/articles/1038524/

#endtoend_шифрование #OPAQUE #HSM #WhatsApp #Meta #криптография #бэкапы #мессенджеры #RFC_9807 #информационная_безопасность

#opaque : impervious to the rays of light

- French: opaque

- German: undurchsichtig, opak

- Italian: opaco

- Portuguese: opaco

- Spanish: opaco

------------

Try our new word guessing game @ https://24hippos.com

Updated the docs for my pure-Java implementation of OPAQUE (client and server) with also a typescript client. https://codeheadsystems.github.io/hofmann-elimination/

I included links to other known projects, different languages and levels of maturity. I'm finishing up the main code and have examples of integrations. As that gets solidified, I need to find some group to do a security analysis of it. Apache 2 licensed.

#opaque #java #cryptography #infosec

I just published an RFC compliant Java implementation of OPAQUE/OPRF. OPAQUE provides authentication without the need to share the passwords... rendering server's authentication database useless for offline attacks. This implementation, with Typescript/Client support and Open API specs, can be found here: https://github.com/codeheadsystems/hofmann-elimination

I'd love to get a few eyes on it, looking for comments or security concerns. It's Apache 2 licensed and I'd love to get this (or something like it) everywhere to reduce the value of powning servers. I plan more ports to other languages, go, rust, c#.

#Java #Authentication #cryptography #infosec #opaque #oprf #rfc

#opaque : impervious to the rays of light

- French: opaque

- German: undurchsichtig, opak

- Italian: opaco

- Portuguese: opaco

- Spanish: opaco

------------

Try our new word guessing game @ https://24hippos.com

Today was #rage and #pullrequests.

1. Yes, #hardcoded #opaque identifiers are a little tiny bit faster in this task that runs for a couple of minutes on an irregular, on-demand basis. But maybe you should look up those monstrosities starting from their #humanfriendly equivalents which are much more descriptive.

2. Fine, you wrote some #shellscript with #LLM. It's not very #DRY and it interfaces poorly with the #pipeline syntax. This will require #commits to a branch, not just a #review.

Credit card companies in Canada (and elsewhere) have been imposing draconian restrictions on the use of their payment networks for anything even slightly racy -- digital Puritanism, enforced by a handful of companies that have a combined monopoly stranglehold on payment systems.

Risque video content? Racy text? Erotic drawings? All forbidden to one degree or another, by un-elected moral crusaders that you simply can't choose to not use. If you're a content creator depending on payments / subscriptions, you can be demonitized instantly, with no explanation and no recourse, at any moment. Goodbye, income!

This petition isn't perfect - it's written solely from the point of view of someone concerned with the effects on the videogame market, not any other type of content creator - but it's a start. If you're in Canada and want payment processors to not engage in such discriminatory practices, take a look at this (brief) petition and consider signing it.

https://www.ourcommons.ca/petitions/en/Petition/Details?Petition=e-6695

#PaymentProcessor #CreditCardCompanies #Puritanism #demonitized #opaque #stealth #Canada #censorship #content #ContentCreator #mature #adult

#opaque : impervious to the rays of light

- French: opaque

- German: undurchsichtig, opak

- Italian: opaco

- Portuguese: opaco

- Spanish: opaco

------------

Word of The Hour's Annual Survey @ https://wordofthehour.org/r/form